fix(notifications): send every group notification to a group an install has, and that can read the object

[rubenvdlinde]

Scope

Twenty notification rules sent to groups named by role words (coordinator, mentor, examboard, exam-board, study-advisor, compliance-officer) that no install provisions, so they fired and reached nobody. Each now names groups the register declares as oauth2 scopes, chosen so the group can read the object it hears about, and a new register test fails on any group recipient outside that set or outside the schema's read list.

• TRACKER-R2 "ROUND 3 FINAL": notification rules naming unprovisioned role words.
• Mapping (full table in openspec/changes/notification-recipients-provisioned/proposal.md): coordinator to coordinators where coordinators read the object; the exam-board role to compliance-officers (as D23 does for the import guards); study-advisor to team-leads (BSA readers); compliance-officer to compliance-officers; mentor dropped where no mentor field exists, with the rule reaching the staff group that reads the object (AttendanceFlag keeps its mentorId field recipient). Instructors are never added: a mentor rule sent to all instructors would reach every teacher.
• Register: 19 schema versions bumped, info.version 0.30.0 to 0.30.1. x-property-rbac role words are a different vocabulary and are left alone.
• Two register tests that pinned the old words now pin the new groups (AssessmentItemPoolsRegisterTest, AttendanceThresholdRegisterTest).

Change: openspec/changes/notification-recipients-provisioned/.

Verification

• vendor/bin/phpunit --filter NotificationRecipientGroupsAreDeclaredTest red first on development (26 undeclared group names, and groups unable to read their object), green after.
• Full PHPUnit (vendor/bin/phpunit --no-coverage): 2114 tests OK, 5 skipped.
• composer check:strict (TMPDIR in the clone, timeout off): exit 0 (ALL CHECKS PASSED, full suite included).
• npm run lint 0, npm run format 0, npm run check:schema-l10n 0. No test:l10n script.
• Hydra gates (vendored runner, HYDRA_GATE_BASE_REF=origin/development): exit 6, all inherited and identical to development: 3 stub-scan (six untouched services), 25, 49, 55, 60, and 101 (DossierReview, ExchangePartnerApproval, TeldatumCheck without demo rows; LvsResult and OsoImportDossier null dataExchangeJobId, LvsResult fixed in fix(lvs): freeze a verified LVS score now that LvsResult is no longer append-only #1195).
• openspec validate notification-recipients-provisioned valid.

Landing note

Touches lib/Settings/learniq_register.json (info.version and 19 schemas); #1195 (lvs-score-freeze) also bumps info.version.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/learniq @ 0707d29

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 107/107
npm			✅	✅ 747/747
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					❌
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it on any branch from the Actions tab, or locally with npx playwright test.
Hydra gates					❌

---

Quality workflow — 2026-09-28 16:59 UTC

Download the full PDF report from the workflow artifacts.